[taras]

Why

An interrupted Sidekick message can leave the saved message ordinal ahead of the canonical turn. When later automatic feedback advances the turn without saving a message, two evaluated responses can share a control slot and make the chat unreadable.

What changes

Sidekick assigns a private response ID from its acknowledged journal position before it previews or evaluates a reply. The live reply, generated root, controls, outcome, and feedback use that same ID. Canonical turn attribution stays independent. The new IDs occupy a separate namespace from the numeric IDs in older journals.

How to verify it

• The interruption and automatic feedback regression fails on the base with a duplicate control slot. On this commit, each response and operation survives a cold reopen without another provider call.
• A journal produced by the old writer retains its completed control and unfinished question. The next response gets its own ID. A deliberately duplicated control slot still causes the reader to refuse the history.
• The dispatch regression covers cancellation, queued input, and automatic feedback. The admitted entry executes once.
• Focused Deno typecheck, Core generated-root checks, and 135 Sidekick test suites passed on the exact candidate bytes. Independent review and required CI are tracked separately.

Closes #1234.

[taras]

Independent Fable review: PASS on a6c9a9f99e83784bd0ebb6f689f8aac88168772b. Published from the original Fable review receipt produced by the combined XMD workflow. No blocking findings.

Fable verified that response IDs are distinct from legacy IDs and that replies, controls, and feedback use the same ID while turn attribution still comes from the saved turn. Cold reopen preserved both the recorded operations and the journal bytes without new prompts or writes. The duplicate-slot refusal remains in place, and the legacy orphan still reconciles with its own response.

The focused recovery, dispatch, lifecycle, journey, and presentation tests passed. Fable did not rerun the regression against the old writer or run the full CI battery. The uniqueness argument depends on append-only history and appending the request before persisting or showing its response ID. The required CI and main-health gates remain separate.

[taras]

Independent Fable review

PASS on be8729723f0046b7eda4336030aeccee40475fff. Fable reviewed the correction against a6c9a9f99e with performance explicitly in scope and found no blocking issues.

The allocator now reads the length of the same acknowledged record array directly. It keeps the allocation point and response:journal:<n> format and removes one full-history copy per response. The reviewer traced the append and reopen paths and checked that the count is identical. In a scratch probe at one million records, the old count path averaged about 0.96 ms per call and the direct read stayed below the probe’s 0.0001 ms reporting threshold. This measures the count operation.

The collision, legacy reopen, duplicate-refusal, and queued dispatch checks passed. The focused typecheck passed. Required CI and the main-health gate are separate from this verdict.